Data Processing Agreement
Last updated:
This agreement (art. 28 GDPR) covers personal data that you, the customer, store or process on your dedicated SparkHost machine. It forms part of the Terms of Service and applies automatically to every order.
1. Roles
For personal data on your dedicated machine, you are the controller and SparkHost is the processor, only to the extent that hosting your machine (storing the data on Hardware we house, power and connect) counts as processing. You decide which data you put on the machine, why, and for how long. You guarantee that you have a lawful basis for it.
2. Subject matter and nature of the processing
Subject: hosting of dedicated Hardware for the duration of your contract. Nature: storage on the Hardware and the physical handling needed to operate it (installation, power-cycling, repair, replacement and secure wiping). Categories of data subjects and personal data: determined by you. We have no logical access to your machine in normal operation: you hold the root credentials and SSH keys.
3. Instructions
We process the data only on your documented instructions — these terms, your tickets and your use of the Service — unless the law requires otherwise, in which case we inform you unless that is legally prohibited. We access the machine only when you ask us to, when strictly necessary to operate or repair it, or when the law requires it.
4. Confidentiality and security
Everyone at SparkHost who may handle your Hardware is bound by confidentiality. We take appropriate technical and organisational measures, including: housing the Hardware in a secured data centre with access control (Iron Mountain data centre, Amsterdam); one customer per machine; key-based root access controlled by you; logging of staff actions in our systems; and secure wiping of storage before Hardware is reassigned.
5. Sub-processors
You authorise the following sub-processors: Iron Mountain — data-centre housing in Amsterdam, the Netherlands (physical housing, power and connectivity; no logical access); and LeaseWeb Netherlands B.V. — Amsterdam, the Netherlands: hosting of our self-operated mail server (infrastructure provider; data stays in the EU). We inform you by email before adding or replacing a sub-processor that may come into contact with your machine, so you can object; if we can't address the objection you may terminate the affected service.
6. Data location and transfers
Data on your machine stays in the Netherlands. We do not transfer it outside the EEA.
7. Personal data breaches
We notify you without undue delay after becoming aware of a personal data breach affecting your machine (for example physical theft or a security incident at the data centre) and give you the information we have, so you can meet your own obligations.
8. Assistance
Because you control the machine, you handle requests from data subjects and data protection impact assessments yourself. Where you need our help (for example information about the hosting environment), we assist within reason; extraordinary effort may be charged at a reasonable rate agreed in advance.
9. Audits
We provide the information reasonably needed to demonstrate compliance with this agreement on request. On-site audits are possible by prior agreement, at your cost, with reasonable notice and under confidentiality.
10. End of the service
When your contract ends, rented Hardware comes back to us and its storage is securely wiped before it is reassigned; we confirm the wipe on request. Hardware you own is shipped to you or held for collection without accessing the data on it. Make sure you have retrieved your data before the end date.
11. Liability and precedence
The liability provisions of the Terms of Service apply. On data protection matters this agreement prevails over the Terms. Dutch law applies. Need a countersigned copy? Email support@sparkhost.ai.